Trojan.PWS.Steam.15953

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7382677c536cdecb91e378cb72b5caf9_23ef5514-3059-436f-a4a7-4cefaab20eb1
%HOMEPATH%\My Documents\ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt
%HOMEPATH%\Desktop\ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7382677c536cdecb91e378cb72b5caf9_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following system files:

from %WINDIR%\Coffee Bean.bmp to %WINDIR%\Coffee Bean_nn34fopu14m.bmp
from <SYSTEM32>\DirectX\Dinput\lgc209.png to <SYSTEM32>\DirectX\Dinput\lgc209_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\lgc207.png to <SYSTEM32>\DirectX\Dinput\lgc207_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\lgc202.png to <SYSTEM32>\DirectX\Dinput\lgc202_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ia3002_2.png to <SYSTEM32>\DirectX\Dinput\ia3002_2_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ia3002_1.png to <SYSTEM32>\DirectX\Dinput\ia3002_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\gr4005.png to <SYSTEM32>\DirectX\Dinput\gr4005_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\gr4003.png to <SYSTEM32>\DirectX\Dinput\gr4003_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\lgc20a.png to <SYSTEM32>\DirectX\Dinput\lgc20a_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\gr4001_g.png to <SYSTEM32>\DirectX\Dinput\gr4001_g_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\gr3001.png to <SYSTEM32>\DirectX\Dinput\gr3001_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\glmdiggp.png to <SYSTEM32>\DirectX\Dinput\glmdiggp_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\glmda.png to <SYSTEM32>\DirectX\Dinput\glmda_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\act_rs.png to <SYSTEM32>\DirectX\Dinput\act_rs_nn34fopu14m.png
from <SYSTEM32>\wpa.dbl to <SYSTEM32>\wpa_nn34fopu14m.dbl
from <SYSTEM32>\setup.bmp to <SYSTEM32>\setup_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\gr4001.png to <SYSTEM32>\DirectX\Dinput\gr4001_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\lgc291.png to <SYSTEM32>\DirectX\Dinput\lgc291_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms1b.png to <SYSTEM32>\DirectX\Dinput\ms1b_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms1b_01.png to <SYSTEM32>\DirectX\Dinput\ms1b_01_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_m.png to <SYSTEM32>\DirectX\Dinput\ms3b_m_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_c.png to <SYSTEM32>\DirectX\Dinput\ms3b_c_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_a.png to <SYSTEM32>\DirectX\Dinput\ms3b_a_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_4.png to <SYSTEM32>\DirectX\Dinput\ms3b_4_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_3.png to <SYSTEM32>\DirectX\Dinput\ms3b_3_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_2.png to <SYSTEM32>\DirectX\Dinput\ms3b_2_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b_1.png to <SYSTEM32>\DirectX\Dinput\ms3b_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms3b.png to <SYSTEM32>\DirectX\Dinput\ms3b_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms34_02.png to <SYSTEM32>\DirectX\Dinput\ms34_02_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms34_01.png to <SYSTEM32>\DirectX\Dinput\ms34_01_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms34.png to <SYSTEM32>\DirectX\Dinput\ms34_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms28_8.png to <SYSTEM32>\DirectX\Dinput\ms28_8_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms28.png to <SYSTEM32>\DirectX\Dinput\ms28_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms27_1.png to <SYSTEM32>\DirectX\Dinput\ms27_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms27.png to <SYSTEM32>\DirectX\Dinput\ms27_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms26_01.png to <SYSTEM32>\DirectX\Dinput\ms26_01_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms26.png to <SYSTEM32>\DirectX\Dinput\ms26_nn34fopu14m.png
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl_nn34fopu14m.bmp
from <SYSTEM32>\DirectX\Dinput\ms3b_t.png to <SYSTEM32>\DirectX\Dinput\ms3b_t_nn34fopu14m.png
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula_nn34fopu14m.rtf
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp to %WINDIR%\pchealth\helpctr\System\images\32x32\logo_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow_nn34fopu14m.bmp
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe_nn34fopu14m.jpg
from %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp to %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula_nn34fopu14m.rtf
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options_nn34fopu14m.bmp
from <SYSTEM32>\DirectX\Dinput\ms56.png to <SYSTEM32>\DirectX\Dinput\ms56_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms56_1.png to <SYSTEM32>\DirectX\Dinput\ms56_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms6.png to <SYSTEM32>\DirectX\Dinput\ms6_nn34fopu14m.png
from <SYSTEM32>\oobe\images\wpabtm.jpg to <SYSTEM32>\oobe\images\wpabtm_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\wpaback.jpg to <SYSTEM32>\oobe\images\wpaback_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\thanks8.png to <SYSTEM32>\oobe\images\thanks8_nn34fopu14m.png
from <SYSTEM32>\oobe\images\thanks10.png to <SYSTEM32>\oobe\images\thanks10_nn34fopu14m.png
from <SYSTEM32>\oobe\images\skipup.jpg to <SYSTEM32>\oobe\images\skipup_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\skipover.jpg to <SYSTEM32>\oobe\images\skipover_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\skipoff.jpg to <SYSTEM32>\oobe\images\skipoff_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\wpakey.jpg to <SYSTEM32>\oobe\images\wpakey_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\wpaflag.jpg to <SYSTEM32>\oobe\images\wpaflag_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\nextup.jpg to <SYSTEM32>\oobe\images\nextup_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\nextover.jpg to <SYSTEM32>\oobe\images\nextover_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\nextoff.jpg to <SYSTEM32>\oobe\images\nextoff_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\nextdown.jpg to <SYSTEM32>\oobe\images\nextdown_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newtop8.jpg to <SYSTEM32>\oobe\images\newtop8_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newtop1.jpg to <SYSTEM32>\oobe\images\newtop1_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newmark8.jpg to <SYSTEM32>\oobe\images\newmark8_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\skipdown.jpg to <SYSTEM32>\oobe\images\skipdown_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Wind.jpg to %WINDIR%\Web\Wallpaper\Wind_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\wpatop.jpg to <SYSTEM32>\oobe\images\wpatop_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\Vortec space_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Tulips.jpg to %WINDIR%\Web\Wallpaper\Tulips_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\Stonehenge_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Ripple.jpg to %WINDIR%\Web\Wallpaper\Ripple_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\Red moon desert_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Radiance.jpg to %WINDIR%\Web\Wallpaper\Radiance_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\Purple flower_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Power.jpg to %WINDIR%\Web\Wallpaper\Power_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\Peace_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Moon flower.jpg to %WINDIR%\Web\Wallpaper\Moon flower_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\Home_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Friend.jpg to %WINDIR%\Web\Wallpaper\Friend_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\Follow_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Crystal.jpg to %WINDIR%\Web\Wallpaper\Crystal_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Bliss.bmp to %WINDIR%\Web\Wallpaper\Bliss_nn34fopu14m.bmp
from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\Azul_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Autumn.jpg to %WINDIR%\Web\Wallpaper\Autumn_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newmark1.jpg to <SYSTEM32>\oobe\images\newmark1_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\oemcoa.jpg to <SYSTEM32>\oobe\images\oemcoa_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newbtm8.jpg to <SYSTEM32>\oobe\images\newbtm8_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\newbtm1.jpg to <SYSTEM32>\oobe\images\newbtm1_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\mslogo.jpg to <SYSTEM32>\oobe\images\mslogo_nn34fopu14m.jpg
from <SYSTEM32>\DirectX\Dinput\msprw.png to <SYSTEM32>\DirectX\Dinput\msprw_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\sv2512.png to <SYSTEM32>\DirectX\Dinput\sv2512_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\sv2511.png to <SYSTEM32>\DirectX\Dinput\sv2511_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\SV-262e4.png to <SYSTEM32>\DirectX\Dinput\SV-262e4_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\SV-262e3.png to <SYSTEM32>\DirectX\Dinput\SV-262e3_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\SV-262e1.png to <SYSTEM32>\DirectX\Dinput\SV-262e1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\msprw_2.png to <SYSTEM32>\DirectX\Dinput\msprw_2_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\msprw_1.png to <SYSTEM32>\DirectX\Dinput\msprw_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\msf1f.png to <SYSTEM32>\DirectX\Dinput\msf1f_nn34fopu14m.png
from <SYSTEM32>\ias\ias.mdb to <SYSTEM32>\ias\ias_nn34fopu14m.mdb
from <SYSTEM32>\DirectX\Dinput\mse_1.png to <SYSTEM32>\DirectX\Dinput\mse_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\mse.png to <SYSTEM32>\DirectX\Dinput\mse_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms8_1.png to <SYSTEM32>\DirectX\Dinput\ms8_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms8.png to <SYSTEM32>\DirectX\Dinput\ms8_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms7_1.png to <SYSTEM32>\DirectX\Dinput\ms7_1_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms7.png to <SYSTEM32>\DirectX\Dinput\ms7_nn34fopu14m.png
from <SYSTEM32>\DirectX\Dinput\ms6_9.png to <SYSTEM32>\DirectX\Dinput\ms6_9_nn34fopu14m.png
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula_nn34fopu14m.rtf
from <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzanom_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzano_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelbm_nn34fopu14m.jpg
from <SYSTEM32>\ias\dnary.mdb to <SYSTEM32>\ias\dnary_nn34fopu14m.mdb
from <SYSTEM32>\oobe\images\backup.jpg to <SYSTEM32>\oobe\images\backup_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\backover.jpg to <SYSTEM32>\oobe\images\backover_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\backoff.jpg to <SYSTEM32>\oobe\images\backoff_nn34fopu14m.jpg
from <SYSTEM32>\oobe\images\backdown.jpg to <SYSTEM32>\oobe\images\backdown_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\veronam.jpg to <SYSTEM32>\oobe\html\mouse\images\veronam_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\verona.jpg to <SYSTEM32>\oobe\html\mouse\images\verona_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\venicem.jpg to <SYSTEM32>\oobe\html\mouse\images\venicem_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\venice.jpg to <SYSTEM32>\oobe\html\mouse\images\venice_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrolm_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrol_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\praguem.jpg to <SYSTEM32>\oobe\html\mouse\images\praguem_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\prague.jpg to <SYSTEM32>\oobe\html\mouse\images\prague_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\pisam.jpg to <SYSTEM32>\oobe\html\mouse\images\pisam_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\pisa.jpg to <SYSTEM32>\oobe\html\mouse\images\pisa_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\parism.jpg to <SYSTEM32>\oobe\html\mouse\images\parism_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\paris.jpg to <SYSTEM32>\oobe\html\mouse\images\paris_nn34fopu14m.jpg
from <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelb_nn34fopu14m.jpg
from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\Ascent_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula_nn34fopu14m.rtf
from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\img136_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img126.jpg to %WINDIR%\Help\Tours\htmlTour\img126_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\img123_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img121.jpg to %WINDIR%\Help\Tours\htmlTour\img121_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\img116_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img110.jpg to %WINDIR%\Help\Tours\htmlTour\img110_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\img109_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img149.jpg to %WINDIR%\Help\Tours\htmlTour\img149_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img103.jpg to %WINDIR%\Help\Tours\htmlTour\img103_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img089.jpg to %WINDIR%\Help\Tours\htmlTour\img089_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\img074a_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img072.jpg to %WINDIR%\Help\Tours\htmlTour\img072_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\img068_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img060.jpg to %WINDIR%\Help\Tours\htmlTour\img060_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\img046_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img040.jpg to %WINDIR%\Help\Tours\htmlTour\img040_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\img100_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\intro_logo_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\logo.jpg to %WINDIR%\Help\Tours\htmlTour\logo_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\pen_icon_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\ul_logo_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg to %WINDIR%\Help\Tours\htmlTour\taskbar_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\start_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\question_icon.jpg to %WINDIR%\Help\Tours\htmlTour\question_icon_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\img034_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img033a.jpg to %WINDIR%\Help\Tours\htmlTour\img033a_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img014.jpg to %WINDIR%\Help\Tours\htmlTour\img014_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_big_nn34fopu14m.jpg
from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec_nn34fopu14m.bmp
from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\Santa Fe Stucco_nn34fopu14m.bmp
from %WINDIR%\River Sumida.bmp to %WINDIR%\River Sumida_nn34fopu14m.bmp
from %WINDIR%\Rhododendron.bmp to %WINDIR%\Rhododendron_nn34fopu14m.bmp
from %WINDIR%\Prairie Wind.bmp to %WINDIR%\Prairie Wind_nn34fopu14m.bmp
from %WINDIR%\Greenstone.bmp to %WINDIR%\Greenstone_nn34fopu14m.bmp
from %WINDIR%\Gone Fishing.bmp to %WINDIR%\Gone Fishing_nn34fopu14m.bmp
from %WINDIR%\FeatherTexture.bmp to %WINDIR%\FeatherTexture_nn34fopu14m.bmp
from %WINDIR%\Soap Bubbles.bmp to %WINDIR%\Soap Bubbles_nn34fopu14m.bmp
from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\img004b_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\icon_up.jpg to %WINDIR%\Help\Tours\htmlTour\icon_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\folder_up.jpg to %WINDIR%\Help\Tours\htmlTour\folder_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\end_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\control_up.jpg to %WINDIR%\Help\Tours\htmlTour\control_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_big_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\img033_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_big_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common_nn34fopu14m.targets
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA_nn34fopu14m.rtf
from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\window_up_nn34fopu14m.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost_nn34fopu14m.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark_nn34fopu14m.bmp
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035_nn34fopu14m.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032_nn34fopu14m.rtf
from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\Windows XP_nn34fopu14m.jpg

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8_nn34fopu14m.db
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo_nn34fopu14m.png
from %ProgramFiles%\Movie Maker\Shared\Sample2.jpg to %ProgramFiles%\Movie Maker\Shared\Sample2_nn34fopu14m.jpg
from %ProgramFiles%\Movie Maker\Shared\Sample1.jpg to %ProgramFiles%\Movie Maker\Shared\Sample1_nn34fopu14m.jpg
from %ProgramFiles%\Movie Maker\Shared\paint.png to %ProgramFiles%\Movie Maker\Shared\paint_nn34fopu14m.png
from %ProgramFiles%\Movie Maker\Shared\news.png to %ProgramFiles%\Movie Maker\Shared\news_nn34fopu14m.png
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview_nn34fopu14m.png
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo_nn34fopu14m.png
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod_nn34fopu14m.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3_nn34fopu14m.db
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_nn34fopu14m.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity_nn34fopu14m.png
from %ProgramFiles%\Windows Media Player\npds.zip to %ProgramFiles%\Windows Media Player\npds_nn34fopu14m.zip
from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table_nn34fopu14m.bmp

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view
'<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial